Enable self-service password reset for all users

Description

Self-service password reset (SSPR) is enabled with the scope All. Every user can reset a forgotten password or unlock their account after proving their identity with the authentication methods they registered, without calling the help desk.

Administrators always use the separate administrator reset policy (two methods, set by Microsoft) whatever this scope.

There is no Microsoft Graph API to read the SSPR scope: the check is made in the portal. SSPR for cloud users needs at least a Microsoft 365 business plan or Microsoft Entra ID P1; writeback for hybrid users needs P1.

Rationale

A recovery path that relies on a human verifying identity over the phone is what attackers abuse to take over accounts (help-desk social engineering). A self-service reset based on registered methods is both faster for users and harder to talk through. It also lets users clear a smart lockout (CB-M365-AUTH-038) themselves.

Impact

Users must register reset methods (CB-M365-AUTH-041). For synchronized users, the reset only works on-premises if password writeback is enabled in Microsoft Entra Connect or Cloud Sync. Help-desk procedures change: the help desk no longer resets passwords on a phone call alone.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Password reset > Properties.
3. Check that Self service password reset enabled is set to All.
4. For hybrid tenants, browse to Password reset > On-premises integration and check that password writeback is enabled.
5. Fail if the setting is None or Selected.

Remediation

1. Make sure the authentication methods and registration settings are ready (CB-M365-AUTH-040, CB-M365-AUTH-041) and, for hybrid users, that password writeback is enabled in the sync client.
2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
3. Browse to Entra ID > Password reset > Properties.
4. Pilot with Selected and a test group if SSPR was never used, then set Self service password reset enabled to All and Save.
5. Update the help-desk procedure and inform users (https://aka.ms/sspr to reset, https://aka.ms/mysecurityinfo to register).

Rollback

Set the scope back to Selected with a group, or None.

References

• Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Microsoft, vendor-doc, accessed 2026-10-24
• How self-service password reset works Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUTH-038 Lock accounts after {{ lockout_threshold }} failed sign-ins for at least {{ lockout_duration_seconds }} seconds
• related CB-M365-AUTH-040 Require two methods to reset a password with SSPR
• related CB-M365-AUTH-041 Require SSPR registration at sign-in and reconfirmation every {{ sspr_reconfirm_days }} days
• related CB-M365-AUTH-042 Notify users when their password is reset
• related CB-M365-AUTH-043 Notify all Global Administrators when an administrator resets their password
• related CB-M365-AUTH-030 Block or force secure remediation for users at high risk
• related CB-M365-AUTH-009 Complete the migration to the Authentication methods policy
• related CB-M365-ADMIN-015 Disable self-service password reset for administrators

People and lifecycle